The ZFS_IOC_SET_PROP ioctl, used by zfs-set(8), incorrectly validated the calling user such that an unprivileged user is able to set metadata on a… (CVE-2026-49431)

The vulnerability arises from improper user validation in the ZFS_IOC_SET_PROP ioctl interface, which is used by the zfs-set(8) command. This flaw permits any local user without elevated privileges to modify internal ZFS metadata by setting the "$hasrecvd" flag on datasets. This flag is intended to reflect that the dataset has received properties from a zfs-recv(8) stream, but due to the validation bypass, unauthorized users can manipulate this metadata.

An unprivileged local user can alter internal ZFS metadata flags on datasets, potentially affecting system behavior or security policies that rely on the "$hasrecvd" flag. The exact impact on system security or data integrity is not detailed in the provided information. There is no indication of remote exploitation or active exploits in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict local user access to systems running vulnerable versions and monitor for unauthorized use of zfs-set(8).